.gitea/workflows/test-ci.yml

@@ -1,4 +1,9 @@
-lint-and-format:
+name: DevSecOps Pipeline - V1 Infrastructure
+
+on: [push, pull_request]
+
+jobs:
+  lint-and-format:
     name: Code & Config Linting (Yamllint & Hadolint)
     runs-on: host
     steps:
@@ -18,3 +23,29 @@ lint-and-format:
           else
             echo "Aucun Dockerfile détecté, étape ignorée."
           fi
+
+  gitleaks-scan:
+    name: Secret Detection (Gitleaks)
+    runs-on: host
+    needs: lint-and-format
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Gitleaks via Podman
+        run: |
+          echo "🔍 Lancement du scan Gitleaks..."
+          podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
+
+  trivy-iac-scan:
+    name: IaC Security & Vulnerability Scan (Trivy)
+    runs-on: host
+    needs: gitleaks-scan
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy IaC Scan
+        run: |
+          echo "🛡️ Analyse des configurations d'infrastructure..."
+          podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path